/*
//////////////////////////////////////////////////
    Script for Asprotect v2.0 
    Author:    loveboom
    Email : bmd2chen@tom.com
    OS    : WinXP sp2,Ollydbg 1.1,OllyScript v0.92
    Date  : 2004-11-15
        Action: Stop stolen code 
    Config: Ignore all exceptions except 'INT 3 breaks'
    Note  : If you have one or more question, email me please,thank  you!
//////////////////////////////////////////////////
*/

var addr

lblask:
  ask "Press 1 clear junkcode,press other key run script."
  cmp $RESULT,1
  je lblcCode

lblsetting:
  msgyn "Setting:Ignore all exceptions except 'INT 3 breaks',Continue?"
  cmp $RESULT,1
  je  lblbp1                    //这里修改一下
  ret

//这里开始改变一下
lblbp1:
  gpa "LoadLibraryA","kernel32.dll"        //获取LOADlibraryA的地址
  mov addr,$RESULT
  add addr,B                    //bp LoadLibraryA+0B
  bp addr
  run

lblbc1:
  bc addr
  rtu                        //返回用户代码
  rtr                        //执行到return处
  sto
  find eip,#E8#                    //查找CALL
  go $RESULT
  sti                        //跟进
  find eip,#8B550C8B128902#            //找处理IAT代码
  mov addr,$RESULT
  add addr,5
  mov [addr],#891A#


//下面调用原来的代码
start:
  dbh
  run
lbl1:
  find eip,#5B5A59C3#        //Found commands 'pop ebx, pop edx, pop ecx, retn'
  cmp $RESULT,0
  je lblerr
  mov addr,$RESULT
  add addr,3
  bp addr


lbl2:
  esto


lbl3:
  cmp eip,addr
  jne lbl2
  bc addr

lbl4:
  find eip,#FF35????????C3#
  cmp $RESULT,0
  je lblerr
  mov addr,$RESULT
  add addr,2
  mov addr,[addr]            //Get push address
  mov addr,[addr]            //Get push value(address)
  bp addr
  run

lbl5:
  cmp eip,addr
  jne lblerr
  bc addr

lbl7:
  cmt eip,"Stolen code."            
  msgyn "Clear Junkcode?"        //CLEAR JUNKCODE?
  cmp $RESULT,0
  je lblend

lblcCode:
 //jmp 01
  repl eip,#2EEB01??#,#90909090#,1000
  repl eip,#65EB01??#,#90909090#,1000
  repl eip,#F2EB01??#,#90909090#,1000
  repl eip,#F3EB01??#,#90909090#,1000
  repl eip,#F3EB01??#,#90909090#,1000
  repl eip,#EB01??#,#909090#,1000
  //jmp 02
  repl eip,#26EB02????#,#9090909090#,1000
  repl eip,#3EEB02????#,#9090909090#,1000
  repl eip,#F3EB02????#,#9090909090#,1000
  repl eip,#EB02????#,#90909090#,1000

lblend:
  msg "Script by loveboom[DFCG][FCG][US],Thank you for using my Scripts!"
  ret
  
lblerr:
  msg "Error!Script aborted.Maybe target is not protect by asprotect 2.0 or your forgot Ignore all exceptions except 'INT 3 breaks'."
  ret
